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Abstract — We consider the problem of designing (or aug- 
menting) an electric power system such that it satisfies the 
N-k-e survivability criterion while minimizing total cost. The 
survivability criterion requires that at least (1 — e) fraction of 
the total demand can still be met even if any k (or fewer) of the 
system components fail. We formulate this problem, taking into 
account both transmission and generation expansion planning, 
as a mixed-integer program. Two algorithms are designed and 
tested on modified instances from the IEEE-30-Bus and IEEE- 
57-Bus systems. 

Index Terms — Long-term grid planning, contingency require- 
ments, decomposition, separation oracle, implicit optimization. 



I. Introduction 

ACCORDING to the Transmission Planning Standard 
(TPL-001-1, defined by the North American Electric 
Reliability Corporation (NERC), power systems are required 
to perform necessary adjustments under normal and con- 
tingency conditions to ensure system reliability. If only a 
single element is lost (A^-l contingency), the system must be 
stable and all thermal and voltage limits must remain within 
applicable rating. The loss-of-load is not allowed for N-l 
contingency. In the case of multiple simultaneous failures (N-k 
contingency), the system still has to meet the stable, thermal 
and voltage limits, but planned or controlled loss-of-load is 
allowed, to a limited degree. 

Recently, optimization methods have been applied to N- 
, k contingency analysis for a large variety of vulnerabilities 
within power systems. For example, line-vulnerability studies 
can be found in O, Q, 10, where optimization methods are 
used to find small groups of lines whose failure can cause 
severe blackout or large loss-of-load. N-k contingencies are 
also considered in optimal power flow models 10, f§), Q and 
unit commitment problems [8.]. The methods used in Q, Q, 
(8) are all based on a bilevel programming approach, which 
is the main method used for network inhibition/interdiction 
problems. 

For power system expansion problem with the added con- 
sideration of contingencies, J5J proposed a multilevel mixed 
integer programming model and solved it by tabu search. They 
use this model to analyze the interaction between a power 
system defender and a terrorist, who seeks to disrupt system 
operations. For the transmission expansion problem, references 
IflOl . IfTTII . Ifl2ll considered the contingency criteria by stochas- 
tic programming and integer programming approaches. The 
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generation expansion problem has recently been studied in 
lfT4l . which pointed to many recent advances. Transmission 
and generation expansion planning problems have also been 
studied in the context of renewable energy integration, see, 

e.g., ma. 

In this paper, we consider the transmission and generation 
expansion planning (TGEP) problem of designing (or aug- 
menting) an electric power system of minimum total cost 
that satisfies the N-k-e survivability criterion. The survivability 
criterion requires that a feasible power flow must still exist, 
satisfying at least (1 — £) fraction of the total demand, even 
after failures of up to k elements of the power system. 
Considering the standards of NERC, for no-contingency state 
and contingency states with k = 1, no loss-of-load is allowed; 
for contingency states with k > 2, a small fraction of total load 
demand can be shed. 

We formulate a mixed-integer nonlinear program (MINLP) 
to model TGEP along with multiple states representing all 
the possible contingency scenarios and the corresponding flow 
variables to ensure that (1 — e) fraction of the demand can 
be met. The combinatorial number of contingency scenarios 
imposes a substantial computational burden. To overcome 
this challenge, we propose two cutting plane algorithms, one 
based on a Benders decomposition method to check the load 
satisfaction of each contingency scenario and another based 
on a custom cutting plane algorithm, which solves a bilevel 
separation problem to determine the worst-case loss-of-load 
under any contingency with up to k failures. To test our models 
and algorithms, numerical experiments are performed on the 
IEEE-30-Bus system and the IEEE-57-Bus system. 

The rest of this paper is organized as follows: In Section 
HI1 the TGEP problem considering the full set of contingency 
scenarios is formulated as a MINLP; Section [III] presents 
two methods to solve this large-scale MINLP; In Section 
IIVI numerical experiments are performed on two IEEE test 
systems; Section W\ concludes the paper. 

II. Models 

A. Nomenclature 
Sets and indices 

/ Set of buses (indexed by i,f), 

S(k) Set of ALL contingency states with k or fewer failures. 

G Set of generating units. 

Gi Set of generating units at bus i. 

E Set of transmission elements. 

Ej Set of transmission elements oriented into bus i. 

Ef Set of transmission elements oriented out of bus i. 

i e ,j e Tail/head (bus no.) of transmission element e = (i e ,j e ). 
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Parameters 



formulated as follows, 



C e 



Investment cost of transmission element e. 



C g Investment cost of generating unit g. 

Cg Marginal production cost of generating unit g. 

Pg Maximum capacity of unit g. 

B e Electrical susceptance of transmission element e. 

F e Capacity of transmission element e. 

Dt Electricity load demand at bus i. 

a Weighting factor to make investment cost and operating 

cost comparable. 
£ Fraction of load demand that can be shed. 
k Contingency budget indicating the maximum number 

of failed elements. 
dg Binary parameter that takes value 1 if generating unit g 

is part of the contingency state s and otherwise. 
d s e Binary parameter that takes value 1 if transmission 

element e is part of the contingency state s and 

otherwise. 

Decision Variables 



Binary generation expansion variable that takes value 
1 if generating unit g is added and otherwise. 
Binary transmission expansion variable that takes value 
1 if transmission element e is added and otherwise. 
Loss of load at bus i for state s. 
Power output of generating unit g for state s. 
Power flow for transmission element e for state s. 
Phase angle of bus i for state s. 
Binary variable that takes value 1 if generating unit g 
is part of the contingency state s and otherwise. 
Binary variable that takes value 1 if transmission 
element e is part of the contingency state s and 
otherwise. 



min Y C e x e + Y C»x„ + a Y C'p 

x,f,p,q,e e f E ^ S 8 i-i 



(la) 



9i 
V\ 

fe 
0/ 

di 



For a contingency state s <E S(k), dt = l and d s e = 1 denote 
generating unit g and transmission element e fails in state 
s, respectively. Conversely, d s g = and d s e = denote that 
both these two elements are available. Therefore, in the no- 
contingency state (s = 0), d^ = and d^ = for all g G G and 
eeE. 



B. TGEP Model 

In the following model, we extend the standard TGEP 
problem to include contingency constraints. Without loss of 
generality, we treat all power system elements as candidates; 
for an existing element, the investment cost (C e ,C g ) can simply 
be set to and the corresponding investment decision (x e ,x g ) 
is fixed to be 1. 

Once the planning decision is made, each newly planned 
element is available in all contingencies scenario s e S(k), 
unless the it is part of a given contingency. Additionally, in 
the no-contingency state (s = 0) no loss-of-load is allowed. 
For contingency state s £ S(k)(s > 0), the total loss-of-load is 
limited by the threshold e. The MINLP model for TGEP is 



geG g€G 

S -t- LP'l+L fe - E fe +Vi = D " V <> < lb ) 

gGG'J eeE s - eeEf 

B e (9f e -9 s Je )x e (l-d s e )-f = 0, Ve,s (lc) 

-F e x e (l-d s e )<f e <F e x e (l-d s e ), Ve,s (Id) 



0<p s g <P g x g (l-d s g ), Wg,s 
0<<fi<D u Vi,Vs ES(k)\0 
£rf<ej>, VseS(k)\0 

iei iei 
9? = 0, Vi 

*,e{o,i}, Vg 

x e €{0,l}, Ve 



(le) 
(If) 
dg) 

(lh) 
(li) 



In all subsequent formulations, unless otherwise specified, the 
indices i,g,e and s are elements of their corresponding sets, 
i.e., i e I 7 g £ G,e e E and s £ S(k). 

The objective ( [Tal l is to minimize the total transmission and 
generation investment cost plus the normalized operating cost 
in the no-contingency state (s = 0). 

Constraints ( fTbb are flow balance requirements for each 
bus and contingency pair. For any transmission element that 
is operational, Kirchhoff's voltage law must be enforced by 
(ITcb . Power flow on transmission element e is governed by 
thermal capacity constraints ( TTdb . For each contingency state, 
the power output of a generating unit must satisfy the upper 
bound given by ( [Tel l. 

The set of all contingency states, S(k) includes the no- 
contingency state s = 0. In the s = state, all power system 
elements are available, and no loss-of-load is allowed, as 
limited by (fThl . 

For contingency state s > 0, constraints ( TTfb and ( lg 



define the loss-of-load at each bus and across all possible 
contingencies, respectively. For contingency state with one 
failed element, no load shedding is allowed (i.e., e = 0). For 
states with two or more failed elements, e > and the bound 
£ Lig/ A limits the total loss-of-load in the system. Therefore, 
for every contingency, at least (1 — e)£ i6 /Oj of demand must 
be satisfied. 

Observe that constraints dTbb-dTfb are specific to a particular 
contingency state, that is, for a given contingency state s, the 
transmission and generation elements in the contingency have 
zero capacity. In the no-contingency state 5 = 0, all invested 
transmission elements and generating units are available for 
the power flow problem. 



III. Solution Approaches 
Replacing constraints ( flcb by 

B e (01 - d s je ) -f+M e (l-x e + dl) > 0, 



B e (et-e s ie )-f e -M e {\ 



-x e + d s e ) < 0, 
VeEE\s £S(k), 



(2) 
(3) 



where M e is sufficiently large constant, formulation (Q3 be- 
comes a large-scale mixed integer linear program (MILP), 
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which we refer as the extensive form (EF). EF has an ex- 
tremely large number of variables and constraints because it 
grows with the number of contingency states, which increases 
exponentially with N and k. For large power systems and/or 
a contingency k greater than one, EF can quickly become 
computationally intractable. In the following sections, we 
modify this formulation and present cutting plane algorithms 
for solving the reformulated problem. 



A. Benders Decomposition 

We begin by presenting an alternative formulation with only 
\G\ + \E\ binary variables but possibly an extremely large 
number of constraints. We use linear programming duality to 
generate valid inequalities for the projection of the natural 
formulation onto the space of the x variables. In essence, we 
use a variant of Benders Decomposition in which we generate 
valid inequalities corresponding to "feasibility" cuts. 

For contingency state s > 0, given a capacity expansion 
vector x and a contingency state vector d s , we solve the 
following linear program, denoted as the primal subproblem 
PSP(x,d s ), to determine an optimal power flow (OPF) that 
minimizes the loss-of-load. 



z(x,d s ) 



- min 

f,p,q,e 



Erf 

iel 



(4a) 
(4b) 



s.t. (a/) ££ + rf=A, V/ 

geGj eeE-] eeEf 

(#) -B e {ei-e s je )+f e <M e {\-x e + d s e ),Ve (4c) 

(ft?) B e (6l-6l)-f e <M e {l-x e + d s e ),\/e (4d) 

[SI) f°<F e x e {l-d s e ),Ve (4e) 

(Tie) -/i<Wl-4),V e (4f) 

(Q) 0<pJ<?^(l-4), Vg (4g) 

(A/) < q\ < D h V/ (4h) 



The objective (1411 ) is to minimize loss-of-load by adjust- 
ing the flow, phase angles and power generation, given the 
prescribed capacity expansion decision x and contingency d s . 
Clearly, if z(x,d s ) > eL, G /A, there does not exist a feasible 
power flow satisfying at least (1 — e) of total demand, and 
if z{x,d s ) < ££ ie; fl„ a feasible power flow exists that can 
satisfy at least (1 — e) of total demand. 

The variables indicated in parenthesis on the left-hand- 
side of the constraints in © denote the corresponding dual 
variables. In turn, we can formulate the dual of this problem, 
DSP(i,cf) as follows, 

. max 2>K + A/)+ J> e (l -Xe + JM + fc) 

a,p,f},8,r),t.,X iel eeE 

+ £ F e x e {\ - d s e M + ri s e ) + I " «*X 

eeE geG 

subject to constraints corresponding to primal variables 
f,p,q,9. Since PSP(i,c/ v ) has a finite optimal solution (in the 
worst case, all load will be shed), DSP (x,d s ) also has a finite 
optimal solution and by strong duality, the optimal solutions 
coincide. Therefore, DSP(i,rf 5 ) has a finite optimal solution, 



and in fact, an optimal extreme point. Thus we can reformulate 
PSP(i,£/" v ) as follows, 

max £A-(«f + A i rf ) + £M e (l-^+^)(^+^) 
' / eeE 

+ £ F e x e {\ - d s e )(S? + r\f) + £ P g x g {\ - J\>.Q'. (5) 

eeE geG 

where L s is the set of extreme points corresponding to the 
polyhedron characterized by dual constraints based on (@| for 
primal variables f,p,q,9. 

Observing that z(x,d s ) < eL lG /A should be satisfied for 
all s G S(k) \ 0, the contingency feasibility conditions can be 
defined as follows, 

£A(af* + \ a ) + Y J M e (l-x e + d^ifif + pf) 

iel eeE 

+ £ F e x e {\ ~ d^){8f + T]f) + £ P gXg (l - 4)Cf (6) 

eeE geG 

<e£A, W=l, 

iel 

Explicitly satisfying demand for the no-contingency state 
and using (|6]l to satisfy the (1 — e) criterion for all contingency 
states with k or fewer failures, we can reformulate (Q} as: 



min £ C e x e + £ Cgx g + a £ C|p° 
x,f,P,q,v e eE gee geG 



(7a) 



s.t. £D f (of f + A/0 + £« ( (1 -x e + d°M e + pf) 

iel eeE 

+ £ F e x e {l-dl){8f + r]t) + £ P g x g (l-J* g )t;f 

eeE geG 

<e£A, V£=l,---,L s ,seS(k)\0 (7b) 





Lf?-Lf? 


= Di, Vie I 




eeEj eeE L 




B e {el- 


el)-f e +M e {\ 


-x e + d%) >0, Ve eE 

i 




el)-f e - Me {\ 


-x e + d%) <0, Ve eE 


-F e (l- 


%)<fe<W 


MeeE 



0<P° g <P g x g (l-d° g ), VgeG 
x g G{0,l}, VgeG 

x e G {0,1}, Me eE 



(7c) 

(7d) 

(7e) 
(If) 
(7g) 
(7h) 
(7i) 



The number of constraints in formulation ([]]) grows ex- 
ponentially with problem size, so we solve it via Benders 
Decomposition (BD). At a typical iteration of BD, we consider 
the relaxed master problem (RMP) (O, which has the same 
objective as (Q~|i but involves only a small subset of the 
constraints in (Q~|i. We briefly outline BD below. For a detailed 
treatment of BD please refer to lfT31l . 

Let j be the iteration counter and let the initial RMP 
be problem (O without any constraints ( PTbl i. Let x 1 be a 
concatenation of the expansion variables (x J e ,x J g ). 
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Algorithm 1 Benders Decomposition (BD) 



ji-0 

solve RMP and let be the solution 
for s = l,-- ,S(k) 

if DSP(V,s) >eE, e /A 

add feasibility cut © to RMP 

end if 
end for 

if Vj= l,-- ,S(k), DSP(jt*,,y) < eZiei D i 

x-i is optimal (EXIT) 
else 

and GOTO step 2 

end if 



follows: 

z{x) =max min 

d f,p,q,e jeI 



(8a) 
(8b) 



By using a Benders reformulation, we are able to decom- 
pose the extremely large MINLP (Q~|i into a master problem 
and multiple subproblems (one for each contingency state). 
In theory, this enables us to solve larger instances, which 
would not be possible by a direct solution of EF. However, 
the extremely large number of contingency states makes direct 
application of Benders ineffective for large power systems 
and/or a non-trivial contingency budget (i.e., k > 1). In the 
next section, we develop a custom cutting plane algorithm 
that evaluates all possible contingency states implicitly using 
a bilevel separation oracle. 



B. Cutting Plane Algorithm 

The size of most power systems in operations, with thou- 
sands of generating units and transmission elements, may 
preclude the direct solution of (|T). Even using a decompo- 
sition algorithm (e.g. BD) may not be feasible because each 
contingency state must be considered explicitly. Our goal is 
to instead use a separation oracle that implicitly evaluates 
all contingency states and either identifies a violated one (a 
contingency with k or less failures) or provides a certificate 
that no such contingency state exists. If such a violated 
contingency exists, we use this contingency to generate a 
Benders cut, as described in the previous section, for the 
RMP. If no such contingency exists, then the current capacity 
expansion (x) is optimal and we terminate. 

1) Power System Inhibition Problem: Given a capacity 
expansion decision (x e ,x g ), the Power System Inhibition Prob- 
lem (PSIP) can be used to determine the worst-case loss-of- 
load under any contingency with k or fewer failures. In this 
bilevel program, the upper level decisions (d e ,d g ) correspond 
to binary contingency selection decisions and the lower level 
decisions (f,p,q,9) correspond to recourse power flow and 
load shedding decisions relative to this given contingency. 

Note that, whereas in the prior model d s was an input pa- 
rameter, in this formulation, we are now selecting the elements 
of the contingency, with d s becoming a decision variable. 
For clarity of exposition, the superscript s corresponding to 
variables f,p,q and 6 have been removed. PSIP is given as 



s.t. £ d e + £ d g < k, 

eeE g£G 

(Of;) £ p g + £ f e - £ /, + q t = D t , Vi e / (8c) 

geGj eeEj eeE L 

(Pe) -B e (9 ie -9j e )+f e <M e {l-x e + d e ),VeeE (8d) 

(fie) B e (9, e - 9 h ) - f e < M e {\ - x e + d e ), Ve e E (8e) 

(8 e ) fe<F e Xe{l-d e ), Ve G E (8f) 

foe) -/,<W(l-4 VeG£ (8g) 

(Cg) 0<p g <Pgtg(l-d g ), Vg G G (8h) 

[Xi) 0<qi<D h Vie I (8i) 



The objective ( l8at is to maximize the minimum loss- 
of-load. Given a contingency state defined by (d e ,d g ), the 
objective of the power system operator (the inner minimization 
problem) is to determine the optimal power flow such that 
the loss-of-load is minimized. Constraint (l8bb is a budget 
constraint limiting the number of power system elements that 
can be in the contingency. Constraints (l8cb are standard flow 
conservation constraints. Constraints dSdl l and ( f8eb together 
enforce Kirchhoff's voltage law, if a transmission element is 
active. Constraints d8B-(8gi are constraints associated with the 
capacity of each transmission element. Constraints d8ffl i limit 
the maximum capacity of each generating unit. If a generating 
unit g is NOT part of the contingency, that is d g = 0, then 
the maximum capacity of the generating unit is enforced, if 
the unit was added (x g = 1). Else, the power output of the 
generating unit must be zero. 

The upper-level decisions of this bilevel program are to 
select a contingency, using the binary variables (d e ,d g ), that 
maximizes the subsequent loss-of-load in the lower-level prob- 
lem. 

Bilevel programs like ([8j cannot be solved directly. One 
approach is to reformulate the bilevel program by dualizing 
the inner minimization problem. For fixed values of d e ,d g , 
the inner minimization problem is a linear program that is 
always feasible. By using duality of linear programs, addi- 
tional variables and disjunctive constraints, we can obtain 
equivalent an equivalent MILP formulation for ©, which 
we call the Dual Power System Inhibition Problem (D-PSIP). 
Bilevel programming approaches were used by |6|, Q to 
perform vulnerability analysis of power systems. 

Next, we outline an algorithm for optimally solving problem 
([T} that combines a Benders decomposition with the aid of an 
oracle given by ©, which acts as a separation subroutine. A 
given capacity expansion (x e ,x g ) is optimal if the oracle cannot 
find a contingency with k or fewer failures that results in a 
loss-of-load above the allowable threshold eL, e /£>, . Whenever 
the oracle determines that the capacity expansion decision 
(x e ,x g ) is notN-k-e compliant, it returns a contingency (d e ,d g ) 
with Y.eeE d e + L ? gg dg < k. This new contingency, given by 
(d e ,d g ), results in a loss-of-load above the allowable threshold. 

Let j be the iteration counter, and let the initial RMP be 
problem Q without any ( ITbl constraints and x ; be the con- 
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catenation of generation and transmission expansion variables. 



Algorithm 2 Cutting Plane Algorithm (CPA) 

l: y<-0 

2: solve RMP and let x' be the solution 

3: solve D-PSIP(x^) and let d j be the solution 

4: if D-Psnv) >eE !e/ A 

5: solve DSP(x J ,d J ') 

6: add feasibility cut © to RMP Q 

7: J «— j + 1 and GOTO step 2 

8: else 

9: x' is optimal (EXIT) 

10: end if 



At each iteration, either a contingency that results in loss- 
of-load above the allowable threshold is identified and a 
corresponding feasibility cut is generated and added to RMP, 
or the algorithm terminates with the current solution being 
optimal (if no failure contingency is found). 

IV. Numerical Experiments 

We implemented the above models and algorithms in C++ 
and CPLEX 12.1 via ILOG Concert Technology 2.9. All 
experiments were run on a machine with four quad-core 2.93G 
Xeon with 96G of memory. For the following computational 
experiments, a single CPU and up to 8GB of RAM was 
allocated. The gap was set to be 0.1% for CPLEX. 

Our models and algorithms are tested on the IEEE-30-Bus 
and IEEE-57-Bus systems 1161 . For each power system, we 
consider five different contingency budgets k. Specifically, we 
limit the contingency cardinality k to be at most zero, one, 
two, three, or four generating units or transmission elements 
in the power system. Altogether, we consider 10 instances. 

Table J] allows us to compare the run times for the three 
different approaches. For each of the 10 instances, m provides 
the number of distinct contingencies. Initially for each test 
system, we replicate a subset of existing generating units and 
transmission lines to create a starting set of candidate ele- 
ments. Using these candidate elements as a starting point, we 
iteratively solve the PSIP problem for k = 4 and e = 0.05 using 
CPA. Using this process, we identify vulnerabilities in the 
power system and introduce additional candidate generation 
and transmission elements. We follow this method to create the 
augmented the IEEE-30-Bus and IEEE-57-Bus test systems for 
the computational experiments presented subsequently. 

Table J] provides the run time (in CPU seconds) for each 
instance under the three different approaches. Note that the 
first approach, the extensive form (EF), can only solve the 
smallest of instances. This is because of the sheer size of 
the problem, in which, for each contingency, a full DCOPF 
problem must be embedded in the formulation. As the number 
of contingencies grows, this quickly becomes intractable. 

The second approach, BD, bypasses this problem via a 
Benders decomposition, with corresponding delayed cut gener- 
ation. However, this still suffers from the combinatorial growth 
in the number of contingency scenarios - for each contingency, 
a subproblem (DSP) must be solved to check for violated 



TABLE I 

Run times for different solution approaches 



Test Systems 






£ 


EF 


BD 


CPA 


IEEE-30-Bus 






















152 


1 





76 


1 


2 




> ILK 


2 


0.05 


X 


51 


15 




> 500AT 


3 


0.10 


X 


2,382 


78 




> 21M 


4 


0.20 


X 


X 


117 


IEEE-57-Bus 






















110 


1 





27 


87 


74 




>5K 


2 


0.05 


X 


513 


15 




> 200K 


3 


0.10 


X 


X 


23 




>5M 


4 


0.20 


X 


X 


24 



feasibility cuts to add to the RMP. We see that larger problem 
instances can be solved, relative to EF, but the BD approach 
nonetheless cannot solve the largest problem instances. 

In the CPA approach, we see that all instances of the 
problem can be solved, in all cases in under two minutes 
and frequently in only a few seconds. This is a result of the 
combination of the strength of the Benders cuts, enabling the 
problem to be solved in a very limited number of iterations, 
and also the fact that we are able to implicitly evaluate the 
contingencies in order to identify a violated contingency and 
then quickly find its corresponding feasibility cut by solving 
a single linear program (DSP). 

Table HT1 provides us with further evidence to support this. 
For each instance, we see the total number of possible con- 
tingency scenarios m and then the number of contingency 
scenarios for which corresponding feasibility cuts were ac- 
tually generated (this is the total number of iterations itr). 
Clearly, it is a very tiny fraction of the possible number 
of contingencies, which is critical to the tractability of the 
approach. The remaining columns of this table breakdown 
the total run time by time spent on the three components of 
the algorithm - the restricted master problem (RMP), which 
identifies a candidate network design x; the power system 
inhibition problem (PSIP), which identifies a contingency that 
cannot be overcome by the current network design; and the 
dual subproblems (DSP), which generates the feasibility cuts. 



TABLE II 
CPA RUNTIME BREAKDOWN 



Test Systems 


m 


k 


e 


RMP 


PSIP 


DSP 


itr 


IEEE-30-Bus 




















1 




152 


1 








2 





6 




> \ \K 


2 


0.05 





14 





8 




> 500AT 


3 


0.10 


1 


78 





14 




>2\M 


4 


0.20 


1 


116 





19 


IEEE-57-Bus 




















1 




110 


1 





46 


28 





103 




>5*r 


2 


0.05 


7 


14 





26 




> 200/f 


3 


0.10 


2 


21 





39 




>5M 


4 


0.20 


1 


23 





39 



V. Conclusion 

In this paper, we proposed models for TGEP with N-k— 
e survivability constraints. Two algorithms are presented and 
tested on standard IEEE test systems. Computational results 
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show the proposed custom cutting plane algorithm (CPA), 
using a bilevel separation program to implicit consider all ex- 
ponential number of contingencies, significantly outperforms 
a standard Benders decomposition. 

The k or fewer failures considered in this paper are assumed 
to happen simultaneously. In order to reflect practical operation 
situations, where failures may happen consecutively, new mod- 
els that consider timing between system element failures will 
be needed. Additionally, unit commitment and de-commitment 
is not considered in our current model. Future research should 
address these considerations. 
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